Random purchase from Taobao via Superbuy.com Bare PCB, no cam, no battery, no case. A9 type PCB size and layout. 18 pin camera connector as seen in other A9s. BK7252UQN68. 2 buttons, 2 LED, one single red the other two-tone blue/green Markings: SC-10024 v1.0.0 TX1 log at 115200 baud: garbled...

regarding the camera and OTA With OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin combined with OpenBK7252__7231u_t_c1b0ac146bf0.rbl from 0x132000 and flashed as one file from 0x0 we see OTA process on first boot Code: TextLog in, to see the code OTA attempts in the web app and gui methods just give malloc failed log.

Interesting, is this supposed to be for developers? Maybe we could ask them to also provide SDK?

no idea on target audience. could try contacting seller I suppose, though not sure how that works through Superbuy

seller was not able/willing to supply this SDK. I have tried to programmatically guess possible Tuya download URLs, but no luck. Added after 1 [hours] 18 [minutes]:dunno if these are of any use for anything Spoiler: Show

So, OTA works. That is good, even though SPI flashing is needed to make it work. Strange thing about malloc failed. Perhaps OTA uses malloc instead of pvPortMalloc? But when i tried to use it it worked fine (with default A9 bootloader).

Shall I try anything new or anything again?

basic question. If I want to route these out for potential use as GPIOs I should definitely make a point of removing the resistors (and bridge through)? No good hooking up sensors and things for testing if there will be things in the way to skew results I figure.

Those resistors are between GPIO and pad? Or between GPIO and ground or VDD? What is their value? Added after 21 :Aren't they a 0 ohm jumpers?

no continuity to ground or vcc. but hang on, this would make a better dev board maybe

And the resistance of the resistor? It may be just a jumper...

green line = continuity Added after 7 [minutes]:so if anything, remove all 3 resistors and bridge the two closest to the test pads?

Taobao Tuya BK7252UQN68 Bare A9 Cam PCB (SC-10024 v1.0.0) - UART/SPI Flash Backup - OpenBK7252

divadiow 3771 76

Report a violation of the law

Reply | New topic

Helpful post

#1 21557995 23 May 2025 14:50

divadiow divadiow

Level 38

Topic author

Helpful post
Post #1
21557995 23 May 2025 14:50

Random purchase from Taobao https://kr.world.taobao.com/item/661235058111.htm via Superbuy.com

Bare PCB, no cam, no battery, no case. A9 type PCB size and layout. 18 pin camera connector as seen in other A9s. BK7252UQN68. 2 buttons, 2 LED, one single red the other two-tone blue/green

Markings: SC-10024 v1.0.0

TX1 log at 115200 baud:

Code: Text
Log in, to see the code

garbled area wasn't readable at any baud

EF custom read from 0x11000 to end of 4mb from TX2/RX2

standard BK7252 preset read stops at 2mb.

soldered up test pads and used Beken SPI Python program and CH341A demonstrated here https://www.elektroda.com/rtvforum/topic4073760.html#21512355

Pads map as:
Taobao A9 PCB Pads Tuya Doorbell Pads CH341A
CE/CEN CE D2
SCK TCK SCK
CSN TMS CS0
SI TDI MOSI
SO TDO MISO
GND GND GND

into SPI Beken SPI mode

NeoProgrammer detects flash - XTX XT25F32B [3.3V] 32 Mbits, 4 Mbytes - SPI ID: 0B4016. Dumps: https://github.com/openshwprojects/FlashDumps/pull/32/files

Pairs with Tuya app

Tuya dev info
Query Things Data Model
Code: JSON
Log in, to see the code

Device Details
Code: JSON
Log in, to see the code

Device Update Info
Code: JSON
Log in, to see the code

From https://github.com/NonPIayerCharacter/OpenBK7231T_App/actions/runs/14322039247

OpenBK7252_Tuya_QIO__7231u_t_c1b0ac146bf0.bin BL boots but no app

Code: Text
Log in, to see the code

OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin boots into OBK!

Forgot to add that, like the doorbell, the OTA mechanism is like the Realteks with OTA1/OTA2 ping-pong.

ty_ipc_lite_sdk

ADVERTISEMENT
#2 21558836 24 May 2025 14:49

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #2
21558836 24 May 2025 14:49

Interesting, is this supposed to be for developers? Maybe we could ask them to also provide SDK?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#3 21558972 24 May 2025 18:30

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #3
21558972 24 May 2025 18:30

no idea on target audience. could try contacting seller I suppose, though not sure how that works through Superbuy
#4 21570227 05 Jun 2025 08:18

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #4
21570227 05 Jun 2025 08:18

seller was not able/willing to supply this SDK. I have tried to programmatically guess possible Tuya download URLs, but no luck.

Added after 1 [hours] 18 [minutes]:

dunno if these are of any use for anything

Spoiler:

https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.0.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.1.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.3.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.4.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.5.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.6.tar.gz
https://airtake-public-data-1254153901.cos.ap...rt/embed/pruduct/tuyaos_demo_ipc_1.0.7.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.10.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.12.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.13.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.14.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.16.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.17.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.18.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.19.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.20.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.21.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.22.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.23.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.24.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.25.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.26.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.28.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.29.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.30.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.31.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.0.32.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.30.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.31.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.32.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.33.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.34.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.35.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.36.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.37.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.39.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.40.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.41.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.42.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.43.tar.gz
https://airtake-public-data-1254153901.cos.ap...t/embed/pruduct/tuyaos_demo_ipc_1.1.50.tar.gz
Helpful post

#5 21570898 05 Jun 2025 20:34

divadiow divadiow

Level 38

Topic author Helpful post? (+1)

Helpful post
Post #5
21570898 05 Jun 2025 20:34

regarding the camera and OTA

With OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin combined with OpenBK7252__7231u_t_c1b0ac146bf0.rbl from 0x132000 and flashed as one file from 0x0 we see OTA process on first boot

Code: Text
Log in, to see the code

OTA attempts in the web app and gui methods just give "malloc failed" log.
ADVERTISEMENT
#6 21570913 05 Jun 2025 20:53

insmod insmod

Level 31

Helpful post? (0)

Post #6
21570913 05 Jun 2025 20:53

So, OTA works. That is good, even though SPI flashing is needed to make it work.
Strange thing about malloc failed. Perhaps OTA uses malloc instead of pvPortMalloc?
But when i tried to use it it worked fine (with default A9 bootloader).
ADVERTISEMENT
#7 21570934 05 Jun 2025 21:12

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #7
21570934 05 Jun 2025 21:12

Shall I try anything new or anything again?
#8 21616367 25 Jul 2025 07:53

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #8
21616367 25 Jul 2025 07:53

basic question. If I want to route these out for potential use as GPIOs I should definitely make a point of removing the resistors (and bridge through)?

No good hooking up sensors and things for testing if there will be things in the way to skew results I figure.
#9 21616422 25 Jul 2025 08:56

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #9
21616422 25 Jul 2025 08:56

Those resistors are between GPIO and pad? Or between GPIO and ground or VDD? What is their value?

Added after 21 [seconds]:

Aren't they a 0 ohm jumpers?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#10 21617248 26 Jul 2025 08:19

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #10
21617248 26 Jul 2025 08:19

no continuity to ground or vcc. but hang on, this would make a better dev board maybe https://www.elektroda.com/rtvforum/topic4073760.html
#11 21617267 26 Jul 2025 08:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #11
21617267 26 Jul 2025 08:58

And the resistance of the resistor? It may be just a jumper...

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#12 21617470 26 Jul 2025 13:34

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #12
21617470 26 Jul 2025 13:34

green line = continuity

Added after 7 [minutes]:

so if anything, remove all 3 resistors and bridge the two closest to the test pads?
#13 21617477 26 Jul 2025 13:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #13
21617477 26 Jul 2025 13:35

Is this a single lane?

I am confused by this 4.7k resistor.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#14 21617484 26 Jul 2025 13:40

divadiow divadiow

Level 38
Topic author Helpful post? (0)

Post #14
21617484 26 Jul 2025 13:40

p.kaczmarek2 wrote:
Is this a single lane?

yes. continuity

Attachments:

IMG_0034.JPG (1.88 MB) You must be logged in to download this attachment.
#15 21617875 26 Jul 2025 22:25

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #15
21617875 26 Jul 2025 22:25

And where this trace goes?

But in general, it's better to remove those resistors....

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#16 21700785 25 Sep 2025 22:34

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #16
21700785 25 Sep 2025 22:34

new movement on this project https://github.com/daniel-dona/beken7252-opencam
#17 21701128 26 Sep 2025 10:51

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #17
21701128 26 Sep 2025 10:51

Which driver code do they use? Can we integrate it?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#18 21701793 27 Sep 2025 06:50

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #18
21701793 27 Sep 2025 06:50

unknown at this point. my head is in TXW mode

recent chats https://github.com/daniel-dona/beken7252-opencam/issues/9#issuecomment-3335409762

Added after 8 [hours] 9 [minutes]:

There's also @Apache02's project which I've still yet to try
https://www.elektroda.com/rtvforum/topic4118348.html#21550713
#19 21703345 28 Sep 2025 16:59

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #19
21703345 28 Sep 2025 16:59

Hey, what is the state of OBK and EF for BK7252UQN68? I didn't follow that branch closely, but I found a board that survived few years at my workplace, including a flood...

I don't have factory backup because I am sure that I overwrote and broke it already, like, few years ago...

Futhermore, it yields me this:

File looks like full of 0xFF with some 00 at start.

The runs for OpenBK7252_Tuya_QIO__7231u_t_c1b0ac146bf0 have expired, were this merged? Is it OpenBK7252_QIO_1.18.181.bin or OpenBK7231U_QIO_1.18.181.bin? Flash with bootloader overwrite or not?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#20 21703382 28 Sep 2025 17:38

insmod insmod

Level 31

Helpful post? (0)

Post #20
21703382 28 Sep 2025 17:38

>>21703345
This is a standard A9, not Tuya. Flash is not encrypted.
Flash OpenBK7252, but not with bootloader overwrite, or you would need to flash it via SPI. And can it even be overwritten in EF?
Though i do recommend to SPI flash bootloader. Because OTA won't work with default one.
ADVERTISEMENT
#21 21703386 28 Sep 2025 17:48

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #21
21703386 28 Sep 2025 17:48

So I can't overwrite bootloader via UART there? Like with BK7231N?

I don't think I have clear access to SPI pins...

Added after 1 [minutes]:

Added after 53 [seconds]:
second attempt:

Added after 1 [minutes]:

strange, there is some random interference

Added after 2 [minutes]:

Hmm managed to write, not sure if by sheer luck or by changing timeouts:

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#22 21703395 28 Sep 2025 17:49

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #22
21703395 28 Sep 2025 17:49

p.kaczmarek2 wrote:
I don't think I have clear access to SPI pins...

with cam removed maybe? I've had some with other pads hidden under cam. And a couple not labelled. eg: in post 1 in this thread- TDO under cam and TMS/TCK unlabelled

#23 21703406 28 Sep 2025 17:58

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Post #23

21703406 28 Sep 2025 17:58

Oh I see, I must have confused cameras, because i am sure I also had one with no SPI... that one has SPI pins under camera.

Ok, TX2 log on power on:


V(0.1.3)
                                                                      
CPSR:0x000000D3
                                                               
R0:0x0000000F
                                                                 
R1:0x00000000
                                                                 
R2:0x00000054
                                                                 
R3:0x00000000
                                                                 
R4:0x00800100
                                                                 
R5:0x00000000
                                                                 
R6:0x00000000
                                                                 
R7:0x00000000
                                                                 
R8:0x00000000
                                                                 
R9:0x00000000
                                                                 
R10:0x00000000
                                                                
R11:0x00000000
                                                                
R12:0x000009C9
                                                                
R13:0x0043F7E4
                                                                
R14(LR):0x000007E3

I have issues with reading back flash memory again.

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.

#24 21703430 28 Sep 2025 18:13

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #24
21703430 28 Sep 2025 18:13

I think the BK7252U doorbell uart was a bit weird so I switched to SPI
#25 21703470 28 Sep 2025 18:35

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #25
21703470 28 Sep 2025 18:35

I've got a correct UART read. It seems that maybe the CPU-intensive work I was doing on my PC interfered with flashing a bit.

My read contains OBK binary, but it seems that I have cleared whole flash in the past, so there is no RF partition, etc.

Maybe I will try to flash some backup on this camera now to see if TX2 outputs anything more

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#26 21703484 28 Sep 2025 18:50

insmod insmod

Level 31

Helpful post? (0)

Post #26
21703484 28 Sep 2025 18:50

>>21703470
The answer is simple - in those A9 cameras there are no RF partition.
My BK7252U camera is the same as yours, and in my old backup there is no RF, and no MAC that i can see.
#27 21703487 28 Sep 2025 18:51

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #27
21703487 28 Sep 2025 18:51

I flashed BK7252-A9-20211124.bin. I had to add a bootloader skip for it:
https://github.com/openshwprojects/BK7231GUIF...mmit/86dfb1f361bc04caac250dbd74d0556c326ff61c
Still same TX2 output (only registers).

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#28 21703696 28 Sep 2025 22:00

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #28
21703696 28 Sep 2025 22:00

did you SPI it yet?
#29 21703888 29 Sep 2025 08:19

p.kaczmarek2 p.kaczmarek2

Moderator Smart Home

Helpful post? (0)

Post #29
21703888 29 Sep 2025 08:19

Not yet, I didn't have time to setup it. So far, I did a fresh reboot of PC and tried again with EF:

Write 1 230400: OK,
Write 2 230400: OK,
Write 3 460800: OK,
Read 1 460800: OK,
Read 2 230400 OK,
Read 3 230400 OK,
Read 4 230400 OK,
Read 5 115200 OK,

Conclusion: do a fresh reboot before using flasher! All CPU intensive programs in the background may interfere...
I had a busy day yesterday so I didn't try with full reboot and I couldn't reboot due to some utilities running, but now I can clearly see it's better....

So, flashing issue is solved - the question now is what to flash via UART to get anything booting? I can't overwrite bootloader with UART there? So for full OTA SPI is a must?

I am creating multiplatform open source firmware (Tasmota replacement), right now supporting BK7231T, BK7231N, XR809, BL602, W800, W600, LN882H and soon supporting RTL and W701:
https://github.com/openshwprojects/OpenBK7231T
If you like my work, support me at: https://paypal.me/openshwprojects

Helpful post? Buy me a coffee.
#30 21704444 29 Sep 2025 17:09

divadiow divadiow

Level 38

Topic author Helpful post? (0)

Post #30
21704444 29 Sep 2025 17:09

did you manage to dump inc BL? I wonder what the partitions are..

Added after 1 [minutes]:

p.kaczmarek2 wrote:
Still same TX2 output (only registers).

oh. maybe yours is messed up anyway?
Create an account, log in here. You will receive points by participating in discussions.
Join this discussion.

Install Elektroda application

Reply | New topic

Report a violation of the law

Topic summary

✨ A bare A9-type PCB (SC-10024 v1.0.0) featuring the BK7252UQN68 chip was purchased from Taobao without camera, battery, or casing. The board includes an 18-pin camera connector, two buttons, and two LEDs (red and two-tone blue/green). Attempts to obtain an SDK from the seller were unsuccessful. Efforts to locate Tuya firmware download URLs programmatically also failed. Flashing combined OpenBK7252 firmware files enabled OTA functionality on first boot, confirming OTA support despite requiring SPI flash programming. Logs indicate successful OTA initialization and app partition erase/write operations. Some malloc failures were observed, possibly due to differences in memory allocation methods between OTA and default A9 bootloader environments. Further testing or suggestions for additional experiments were requested.

FAQ

TL;DR: OTA wrote 794,045 bytes on first boot; "we see OTA process on first boot". Flash OBK by merging bin+rbl, map pads to CH341A, and back up the 4 MB flash. For hardware hackers needing flash backups, OTA layout, and Tuya pairing notes. [Elektroda, divadiow, post #21570898]

Why it matters: It shows how to safely dump, flash, and OTA‑upgrade BK7252 A9 camera PCBs without bricking, using low‑cost tools.

Quick Facts

SoC/PCB: BK7252UQN68 on SC-10024 v1.0.0 A9-size PCB, 18‑pin camera FFC, two buttons, red and blue/green LEDs. [Elektroda, divadiow, post #21557995]
Flash: XTX XT25F32B SPI, 32 Mbit (4 MB), SPI ID 0x0B4016; NeoProgrammer detects and dumps. [Elektroda, divadiow, post #21557995]
UART/Pairing: 115200 baud on TX1; device advertises AP SmartLife‑2640 and pairs in Tuya app. [Elektroda, divadiow, post #21557995]
OTA style: Realtek‑like ping‑pong OTA (OTA1/OTA2); ty_ipc_lite_sdk appears in firmware. [Elektroda, divadiow, post #21557995]
Firmware: OpenBK7252_QIO__7231u_t_c1b0ac146bf0.bin boots OBK; the Tuya_QIO variant boots BL only. [Elektroda, divadiow, post #21557995]

What is this Taobao BK7252 A9 camera PCB and its hardware layout?

It’s a bare A9-style camera PCB marked SC-10024 v1.0.0 using a BK7252UQN68. It includes an 18‑pin camera connector, two buttons, and two LEDs (one red and one blue/green two‑tone). No camera module, battery, or case ship with it. [Elektroda, divadiow, post #21557995]

How do I wire the test pads to a CH341A to back up the SPI flash?

Pad map: CE/CEN→D2, SCK→SCK, CSN→CS0, SI→MOSI, SO→MISO, GND→GND. Then use Beken SPI mode with a CH341A and NeoProgrammer. How‑To: 1) Solder flying leads to pads. 2) Enter Beken SPI mode and power the board. 3) Detect XTX XT25F32B and dump the 4 MB image. [Elektroda, divadiow, post #21557995]

What flash chip and capacity does it use?

The board carries an XTX XT25F32B SPI NOR. Capacity is 32 Mbit (4 MB). Reported SPI ID is 0x0B4016. NeoProgrammer recognizes it reliably for dumps. [Elektroda, divadiow, post #21557995]

What UART settings should I use and what indicates a healthy boot?

Use 115200 baud on TX1. A healthy boot shows BK7251_x logs, Tuya initialization, BLE advertising, and AP start as SmartLife‑2640. You’ll also see Wi‑Fi and watchdog initialization entries and LED status changes in logs. [Elektroda, divadiow, post #21557995]

How can I flash OpenBK7252 and trigger the OTA upgrade on first boot?

Merge OpenBK7252_QIO7231u_t_c1b0ac146bf0.bin with OpenBK72527231u_t_c1b0ac146bf0.rbl at 0x132000 and flash from 0x0. On first boot, the OTA engine writes 794,045 bytes to the app partition, then boots OBK. Watch serial logs to confirm erase and write progress. [Elektroda, divadiow, post #21570898]

Does OTA work on this A9 BK7252 board?

Yes. “So, OTA works.” Users report success, though initial SPI flashing may be needed to stage images. Using the default A9 bootloader helped in testing. [Elektroda, insmod, post #21570913]

Why do OTA uploads via the web GUI fail with “malloc failed”?

Logs show OTA attempts via the web and GUI ending with “malloc failed.” A practical workaround is pre‑staging the RBL at 0x132000 and flashing a merged image so the device upgrades itself on first boot. [Elektroda, divadiow, post #21570898]

What OTA layout and addresses are involved on this board?

The boot log shows a ping‑pong scheme erasing the download RBL at 0x132000. Combining the .bin base and .rbl at that offset enabled the on‑boot OTA to rewrite the app partition. [Elektroda, divadiow, post #21570898]

How far can the built‑in UART preset read, and how do I dump the full 4 MB?

The standard BK7252 preset read stops around 2 MB. Use the EF custom read from 0x11000 via TX2/RX2 to reach the end, or use CH341A SPI to dump the full 4 MB directly. [Elektroda, divadiow, post #21557995]

Which OpenBK builds boot correctly on this board?

OpenBK7252_QIO7231u_t_c1b0ac146bf0.bin boots into OBK. The OpenBK7252_Tuya_QIO7231u_t_c1b0ac146bf0.bin shows bootloader output but no app, ending with an ARM anomaly on jump. [Elektroda, divadiow, post #21557995]

Can I pair it with Tuya and view its data model (DPs)?

Yes. It pairs and reports device details (firmware 1.0.4). The model exposes DPs such as basic_indicator, basic_nightvision, sd_status, sd_format, record_switch, device_restart, and others useful for IPC features. [Elektroda, divadiow, post #21557995]

Is an SDK available for this board or Tuya IPC?

The seller did not provide the SDK. However, public TuyaOS IPC demo archives exist (tuyaos_demo_ipc versions 1.0.x through 1.1.50) hosted on Tuya’s Airtake storage. [Elektroda, divadiow, post #21570227]

How do I enter Beken SPI mode and verify flash access?

After wiring the pads, power the board and use the Beken SPI Python tool with CH341A. NeoProgrammer should detect XTX XT25F32B (ID 0x0B4016) and allow read/write operations, confirming SPI access. [Elektroda, divadiow, post #21557995]

What LEDs and buttons exist, and can I control indicators from Tuya?

The PCB has two buttons and two LEDs: a single red and a blue/green bi‑color. The Tuya DP basic_indicator toggles the status LED behavior from the app’s settings page when paired. [Elektroda, divadiow, post #21557995]

Should I remove series resistors when repurposing lines as GPIOs?

Yes. Remove the series resistors to avoid unintended loading and get clean GPIO behavior. As an expert noted, “it’s better to remove those resistors.” [Elektroda, p.kaczmarek2, post #21617875]

Taobao A9 PCB Pads	Tuya Doorbell Pads	CH341A
CE/CEN	CE	D2
SCK	TCK	SCK
CSN	TMS	CS0
SI	TDI	MOSI
SO	TDO	MISO
GND	GND	GND